Certified Ethical Hacker (CEH) Practice Question

Vertical privilege escalation occurs when an attacker obtains higher privileges than originally assigned. If the server fails to verify the integrity signature inside the cookie, changing the role field from "user" to "admin" and replaying the request to an administrator-only endpoint directly tests whether the application authorizes actions solely on client-supplied data. A successful response would confirm the weakness. Simply modifying the uid field tests horizontal, not vertical, privilege escalation. Encrypting the cookie with XOR or deleting it to attempt CSRF do not target the authorization check tied to the role attribute, so they would not validate this specific flaw.